tokenclaims-rayls[.]com

This domain, tokenclaims-rayls.com, operates as a brand impersonation platform specifically targeting users of the OKX cryptocurrency exchange. Analysis indicates the site was designed to mimic legitimate OKX reward or token claim pages, likely distributing fraudulent forms to harvest login credentials, private keys, or other sensitive authentication details. The infrastructure exhibits characteristics consistent with credential phishing campaigns, where victims are lured into entering account information under false pretenses of exclusive offers or airdrops. Infrastructure analysis reveals the domain was registered on December 1, 2025, through NameSilo, LLC, a registrar frequently observed in phishing operations. It resolves to the IP address 172.67.140.26 and is currently flagged by 2 distinct security blocklists. Detection engines on VirusTotal report 2 out of 95 security vendors identifying the domain as malicious, while independent trust scoring systems assign it a 0 out of 100 trust rating. The page title, 'Just a moment...', suggests the use of anti-bot or evasion techniques to delay or obscure malicious content from automated analysis tools. Users who visited tokenclaims-rayls.com should immediately revoke any sessions or credentials entered on the site. It is recommended to reset passwords for OKX and any associated accounts, particularly if identical credentials were reused. Enable multi-factor authentication where available and monitor account activity for unauthorized transactions. If cryptocurrency wallets were connected, consider transferring assets to a new wallet and auditing all connected applications for suspicious permissions. Report the incident to the targeted platform’s security team and relevant abuse contacts for further mitigation.